Zavy360 | Zavy360

Dental practices hold some of the most sensitive personal data of any small business. Patient health records, medical histories, Medicare numbers, private health fund details, financial information, and personal identifiers are all stored and processed daily. In Australia, this data is protected by specific legislation, and practice owners have a legal obligation to ensure their technology systems meet these requirements.

Choosing practice management software is not just a clinical or operational decision -- it is a data security decision. The software you use determines where patient data is stored, how it is protected, who can access it, and what happens if something goes wrong. Practice owners who treat software selection as a purely functional evaluation, ignoring the security and compliance dimension, expose their practice to legal, financial, and reputational risk.

This guide covers the specific Australian legal framework that applies to dental practice data, the security features you should demand from any software provider, and a practical checklist you can use during your evaluation.

Australian Privacy Law and Dental Practices

Australian dental practices are subject to the Australian Privacy Act 1988, which establishes the 13 Australian Privacy Principles (APPs). These principles govern how organisations collect, use, store, and disclose personal information. For dental practices, the requirements are stricter than for many other small businesses because patient health records are classified as "sensitive information" under the Act -- the highest protection category.

The Australian Privacy Principles That Matter Most

Several APPs have direct implications for how dental practices manage data:

APP 1 (Open and transparent management) requires practices to have a clearly expressed and up-to-date privacy policy that explains how patient information is handled. This includes how the information is collected, the purposes for which it is used, whether it is disclosed to third parties (including software providers), and how patients can access or correct their information.

APP 6 (Use or disclosure) restricts the use of health information to the primary purpose for which it was collected -- providing dental treatment. Using patient data for marketing, sharing it with unrelated third parties, or repurposing it without consent violates this principle.

APP 8 (Cross-border disclosure) is critical when evaluating cloud software providers. If your software stores data on servers outside Australia, you are effectively disclosing personal information overseas. Under APP 8, you remain accountable for ensuring the overseas recipient handles the data in accordance with the APPs. In practice, this means choosing a provider that stores data in Australian data centres is the simplest path to compliance.

APP 11 (Security of personal information) requires practices to take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. This applies to both the practice's physical security and its digital systems -- including the software platform chosen to manage patient records.

AHPRA Record-Keeping Obligations

Beyond the Privacy Act, dental practitioners registered with the Australian Health Practitioner Regulation Agency (AHPRA) have additional record-keeping obligations. Clinical records must be maintained for specific retention periods -- typically a minimum of seven years from the date of last entry for adults, and until the patient turns 25 for minors (whichever is later). Some states have longer retention requirements.

These retention obligations mean your software provider must guarantee long-term data availability and integrity. If you switch providers or if a provider ceases operations, your clinical records must remain accessible for the required retention period. This is not a theoretical concern -- several dental software companies have been acquired or discontinued in the Australian market over the past decade.

The Notifiable Data Breaches Scheme

Since February 2018, the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act requires organisations to notify both the Office of the Australian Information Commissioner (OAIC) and affected individuals when a data breach is likely to result in serious harm.

For dental practices, a notifiable breach could include:

Unauthorised access to patient records (e.g., a staff member accessing records without a clinical reason)
Ransomware attacks that encrypt or exfiltrate patient data
Accidental disclosure of patient information (e.g., emailing records to the wrong recipient)
Loss or theft of devices containing unencrypted patient data

The notification process requires a specific assessment within 30 days of becoming aware of the breach, followed by notification to the OAIC and affected individuals if the breach meets the threshold. Penalties for failing to notify can be significant -- up to $2.5 million for organisations.

Your software provider's security posture directly affects your exposure to data breaches. A provider with weak security increases your risk; a provider with strong security, encryption, and access controls reduces it.

Data Sovereignty -- Why Where Your Data Lives Matters

Data sovereignty refers to the principle that data is subject to the laws and governance structures of the country where it is physically stored. For Australian dental practices, this is a practical concern with real legal implications.

Australian Data Centre Requirements

When patient health data is stored in Australian data centres, it is subject to Australian law -- including the Privacy Act, the NDB scheme, and Australian court jurisdiction. If a dispute arises about data access, a legal process, or a breach, Australian courts have clear jurisdiction.

When data is stored offshore -- even by a nominally "Australian" company -- different rules apply. The data may be subject to foreign government access laws (such as the US CLOUD Act, which allows US authorities to compel US-based companies to produce data stored anywhere in the world). APP 8 of the Privacy Act holds the Australian practice accountable for ensuring the overseas recipient complies with the APPs, but enforcing this is significantly more difficult when the data is in a foreign jurisdiction.

What "Cloud" Means for Data Location

Not all cloud providers host data in Australia. Some use Amazon Web Services, Google Cloud, or Microsoft Azure regions located in Singapore, the United States, or Europe. The fact that the software company has an Australian office does not mean the data is stored in Australia -- these are separate questions.

When evaluating any cloud dental software, ask specifically:

Where are the primary data centres located? (City and country)
Where are the backup/disaster recovery data centres located?
Is any patient data processed or temporarily stored outside Australia?
Can you provide a written guarantee that patient health data remains within Australian borders?

Zavy360's security practices include Australian-hosted data centres with data sovereignty guarantees, ensuring patient records remain under Australian jurisdiction.

Questions to Ask Your Provider

Beyond data location, these questions reveal how seriously a provider takes data sovereignty:

Who owns the data -- the practice or the software provider?
What happens to the data if the provider is acquired by a foreign company?
Can the practice export all data in a standard, usable format at any time?
What is the data retention policy, and does it align with AHPRA requirements?

Security Features to Demand from Your Dental Software Provider

Security is not a feature to be grateful for -- it is a baseline requirement. Here are the specific capabilities every dental software provider should offer.

Encryption at Rest and in Transit

All patient data should be encrypted both in transit (between your browser/device and the server) and at rest (while stored on the server). In-transit encryption should use TLS 1.2 or later. At-rest encryption should use AES-256 or an equivalent standard. Ask the provider for specifics -- "we use encryption" without technical details is not a sufficient answer.

Access Controls and Audit Trails

Your software should support role-based access controls so that each staff member sees only the data relevant to their role. A receptionist should not have the same access as the principal dentist. A hygienist does not need access to financial reports.

Audit trails -- automated logs of who accessed which records and when -- are essential for both security monitoring and compliance with the Privacy Act. If a patient requests to know who has accessed their records (which they are entitled to under the APPs), you need a system that can provide this information quickly and accurately.

Backup and Disaster Recovery

Ask your provider to explain their backup strategy in detail:

How frequently are backups performed? (Continuous or daily at minimum)
Where are backups stored? (Should be geographically separate from the primary data centre)
How long are backups retained?
What is the recovery time objective (RTO) -- how quickly can the system be restored after a failure?
What is the recovery point objective (RPO) -- how much data could be lost in a worst-case scenario?

A provider that cannot answer these questions clearly has not invested sufficiently in disaster recovery.

Regular Security Assessments and Certifications

The provider should conduct regular security assessments -- ideally including third-party penetration testing at least annually. Ask about relevant certifications and compliance frameworks. ISO 27001 certification, SOC 2 Type II compliance, or alignment with the Australian Signals Directorate's Essential Eight are indicators of a mature security programme.

Staff Access Management

Your software should provide administrative controls for managing staff accounts, including:

Individual user accounts (no shared logins)
Role-based permission levels
Automatic session timeouts
Multi-factor authentication (MFA) for remote access
Immediate account deactivation when a staff member leaves the practice

Shared logins -- where multiple staff members use the same username and password -- are a significant security risk and make audit trails meaningless. Every user action should be attributable to a specific individual.

Practical Security Checklist for Practice Owners

Use this checklist when evaluating any dental software provider. Every item should receive a clear yes or no answer -- vague responses are a warning sign.

Data location: Is all patient data stored exclusively in Australian data centres? Can the provider confirm this in writing?
Encryption: Is data encrypted in transit (TLS 1.2+) and at rest (AES-256)? Can the provider specify the encryption standards used?
Access controls: Does the system support role-based access with granular permissions? Can you restrict access to specific record types or functions by role?
Audit trails: Does the system automatically log all data access events? Can you generate an audit report for a specific patient or staff member on demand?
Backup and recovery: Are backups performed at least daily, stored in a geographically separate location, and tested regularly for restoration integrity?
Breach notification: Does the provider have a documented incident response plan? Will they notify you immediately if a breach occurs, and will they assist with your NDB scheme obligations?
Data ownership and portability: Does the practice retain full ownership of its data? Can you export all data in a standard format (e.g., CSV, XML) at any time without additional fees?
Security certifications: Does the provider hold relevant security certifications (ISO 27001, SOC 2) or align with the ASD Essential Eight?
Staff training: Does the provider offer security awareness training or resources for your team? Do they provide guidance on configuring the system securely?
Termination and data return: If you leave the provider, what happens to your data? How long is it retained, and in what format is it returned to you?

Any provider that cannot answer these questions directly -- or that deflects with marketing language rather than technical specifics -- should be evaluated with caution.

Protecting Your Practice and Your Patients

Data security is not an IT problem to delegate -- it is a core practice management responsibility. The Privacy Act, AHPRA requirements, and the NDB scheme create clear legal obligations for dental practice owners. Choosing the right software provider is one of the most impactful decisions you can make to meet these obligations.

The technology exists to protect patient data effectively. Australian-hosted data centres, strong encryption, role-based access, comprehensive audit trails, and reliable backup systems are all available. The practice owner's job is to demand these capabilities, verify them, and hold providers accountable.

For a broader evaluation of cloud-based dental software platforms, including features beyond security, our cloud dental software guide covers what Australian practices should consider when moving to the cloud.

Want to understand how Zavy360 protects your practice data with Australian-hosted infrastructure, encryption, and compliance-ready security? Book a demo and we will walk you through our security architecture and data protection approach.

Dental Data Security in Australia: What Every Practice Owner Must Know